Security audit
Security checks for vulnerabilities and agentic risk
This is a Chinese-language guidance skill that points users through PowPow registration and subscription without running code or handling credentials.
Install only if you want a Chinese-language helper for PowPow onboarding. Complete registration, verification, and payment only on the official PowPow pages, and do not share passwords, verification codes, or payment credentials in chat.
The manifest explicitly sets the skill language to "zh-CN", which indicates a fixed language/locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is clearly documented and justified, which is not present here.
该文件全文以中文提供操作说明与排查信息，没有说明仅面向中文使用者，也没有提供其他语言选择或用户可选语言机制。按规则，未经用户选择即强制特定语言属于自然语言层面的语言/locale 政策问题。
The manifest context says this skill is purely for registration, troubleshooting, and subscription activation, and explicitly excludes creating digital humans. However, the note suggests a shortened display name including '玩地图社交与数字人', which presents excluded product-usage/creative functionality as part of this skill's positioning.
The document is primarily written in Chinese, but line L32 hard-codes the English text "Auto-renews. Cancel anytime." with no indication that users may choose their preferred language. This can violate a language/locale policy when a skill implicitly forces mixed or fixed-language output without opt-in or justification.
Line L38 includes the English-only message "You're All Set!" in an otherwise Chinese document, and no language-selection behavior or regional justification is provided. That creates a natural-language policy concern because the skill guidance appears to enforce a specific language for user-visible output.
No suspicious patterns detected.
